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The Honorable Frank Pallone, Jr. 
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Subcommittee on Environment and Hazardous Materials 
Committee on Energy and Commerce 
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Subject: Homeland Security: Department of Justice's Response to Its 

Congressional Mandate to Assess and Report on Chemical Industry 
Vulnerabilities 

On August 5, 1999, after a number of testimonies expressing concerns about the 
vulnerability of chemical facilities 1 to criminal and terrorist attacks, Congress passed 
the Chemical Safety Information, Site Security and Fuels Regulatory Relief Act 
(CSISSFRRA)/ which, among other things, required the Department of Justice to 
review the vulnerability of these facilities. The act also required the Attorney General 
to prepare two reports — an interim report containing preliminary findings by 
August 5, 2000, and a final report by August 5, 2002. 

Specifically, Justice was to address the extent to which Clean Air Act regulations 
regarding the prevention of accidental releases have resulted in actions, including the 
design and maintenance of safe chemical facilities, that are effective in detecting, 
preventing, and minimizing the consequences of regulated substances that may be 
released as a result of criminal activity. Furthermore, using available data to the 
extent possible and a sample of facilities, and consulting with appropriate state, local, 
and federal government agencies, affected industry, and the public, Justice was to 



'We use the term "chemical facilities" in this report to mean those stationary sources covered under 
section 112(r) of the Clean Air Act. 
2 Pub. L. No. 106-40, 113 Stat. 207 (1999). 
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review the vulnerability of chemical facilities to criminal and terrorist activity, 
current industry practices regarding site security, and the security of transportation 
of regulated substances. Finally, Justice was to include recommendations, if any, for 
reducing the vulnerability of these facilities to criminal and terrorist activities. The 
interim report was to include, at a minimum, preliminary findings from this review, 
the methods used to develop the findings, and an explanation of the activities 
expected to occur that could cause the findings in the final report to differ from those 
in the interim report. The final report was to discuss the complete results of the 
review. CSISSFRRA authorized to be appropriated such sums as necessary to carry 
out the requirements. 

In a separate but related action, the October 2000 Conference report 3 on Justice's 
appropriation act for fiscal year 2001 directed Justice to use $600,000 of the Office of 
Justice Programs, Justice Assistance appropriation for its National Institute of Justice 
to develop, test, and validate a prototype vulnerability assessment methodology to 
assess the security of chemical facilities against terrorist and criminal acts, consistent 
with the CSISSFRRA requirements. 4 

As part of our ongoing study of chemical industry security, you asked us to describe 
Justice's actions to comply with the 1999 congressional mandate to review and report 
on the vulnerability of chemical facilities. This report responds to that request. As 
agreed, we will report early next year on other issues concerning the security of 
chemical facilities. 

Justice Initiated Actions to Study the Vulnerability of the Chemical Industry 
but Has Not Fully Met Its Statutory Requirements 

Justice has only partially fulfilled the requirement to review and report on the 
vulnerability of chemical facilities to terrorist or criminal attack. Justice prepared 
and submitted an interim report to Congress in May 2002. The interim report was 
based on observations made at 1 1 chemical manufacturing facilities Justice visited in 
developing a methodology requested by its appropriations conference committee. 
The facilities visited represent only a small portion of the 15,000 chemical facilities 
subject to the Clean Air Act's risk management plan provisions. While the interim 
report contains the elements required by CSISSFRRA, it was submitted nearly 2 years 
after it was due, and the results cannot be generalized to the industry as a whole. 

Additionally, Justice did not submit its final report to Congress by August 5, 2002, as 
required. Justice told us that because of competing priorities in its budget, it had not 
yet conducted a more comprehensive final study. While Justice determined that it 
did not have adequate funds to conduct the study of the vulnerability of chemical 
facilities to attack, it did not formally request additional funds from Congress for this 
purpose in fiscal year 2001 or 2002. Justice has asked for $3 million in its fiscal year 
2003 budget request and plans to conduct the study and issue the final report if it 
receives these funds. We note that Justice should have used its existing 



3 H.R. Conf. Rept. No. 106-1005, at 223 (2000). 

"The Departments of Commerce, Justice, and State, the Judiciary, and Related Agencies 
Appropriations Act for fiscal year 2001, Pub. L. No. 106-553, 114 Stat. 2762, was not enacted until 
December 21, 2000. 



2 



GAO-03-24R Security of Chemical Facilities 



appropriations for the study. Generally, when Congress imposes a new requirement 
on an agency but does not appropriate funds specifically to implement it, the agency 
must use existing appropriations to fund the requirement. 

Justice's Interim Report Was Based on Observations Made While Developing a 
Methodology to Assess Chemical Facilities' Vulnerability to Terrorist Attack 

Justice determined that the first step in meeting the CSISSFRRA requirements was to 
develop a methodology to assess the security of chemical facilities. On March 31, 
2000, the Justice submitted notice to the House and Senate Committees on 
Appropriations that it planned to transfer $750,000 from the Counterterrorism 
appropriation to the Office of Justice Programs appropriation to develop a 
methodology. According to Justice, the committees disagreed with the transfer and 
Justice elected not to proceed with it. 

A conference committee later directed Justice to use $600,000 of the Office of Justice 
Programs, Justice Assistance appropriation for the department's National Institute of 
Justice to develop, test, and validate a prototype vulnerability assessment 
methodology to assess the security of chemical facilities against terrorist and 
criminal acts, consistent with the CSISSFRRA requirements. 6 

In January 2001, Justice, together with the Department of Energy's Sandia National 
Laboratory, began developing, testing, and validating the vulnerability assessment 
methodology. The methodology provides a tool to identify risks and mitigate the 
consequences of terrorist attacks. In July 2002, Justice made the completed 
methodology publicly available to assist chemical companies in identifying and 
assessing their threats, risks, and vulnerabilities. In addition, chemical industry 
associations are encouraging their members to use this methodology to evaluate their 
facilities. 

On the basis of observations made during the development of the methodology, 
Justice prepared a 12-page interim report to Congress in response to the CSISSFRRA 
requirement. Justice determined that the report contains information that if released 
would pose a threat to national security and therefore has not made it publicly 
available.' As required, the interim report (1) provides preliminary findings, 
(2) discusses the methods used to develop those findings, (3) includes Justice's 
recommendations for reducing the vulnerability of facilities to terrorist activity, and 
(4) explains activities expected to occur that could result in differences between the 
findings in the interim and final reports. The interim report does not assess overall 
security at chemical facilities, but rather, it provides observations Justice made about 
security at a few facilities during the development of the methodology. 



"See B-195007, July 15, 1980; 46 Comp. Gen. 604 (1967); 15 Comp. Gen. 167 (1935). 
6 The October 2000 Conference report on Justice's appropriation act for fiscal year 2001 directed this 
action. Additionally, the Conference report required Justice to submit a report on the findings derived 
from the development of the methodology. Justice submitted this report to its appropriations 
committees in May 2002. 

"Justice made this determination pursuant to 42 U.S.C. 7412(r)(7)(H)(xi)(III). 
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Interim Report's Preliminary Findings 

The interim report discusses two preliminary findings that address the extent to 
which the Clean Air Act's accidental release regulations have resulted in actions that 
are effective in detecting, preventing, and minimizing the consequences of releases of 
regulated substances that may be caused by criminal and terrorist activity. According 
to the report, chemical facilities visited generally had safety and emergency response 
measures that could mitigate the consequences of a terrorist attack. 8 The report 
further stated that the level of security at chemical facilities is roughly equivalent to 
standard security practices found in most industries. However, we could not 
determine from our discussions with Justice officials what work was performed to 
support this finding, and we are continuing to investigate this issue as part of our 
ongoing review. 

The interim report also contains nine preliminary findings that cumulatively address 
the other required reporting elements — the vulnerability of facilities to criminal and 
terrorist activity, current industry site security practices, and the security of 
chemicals being transported. These findings address the extent to which the 11 
facilities 

• conducted facility security assessments, 

• had the capability to respond to armed attacks, 

• conducted emergency response exercises, 

• conducted routine pre-employment background investigations, 

• had secure process control systems, 

• had secure chemical transportation containers, 

• had adequate security measures over transportation of hazardous chemicals, 

• received meaningful threat information, and 

• had effective facility security systems. 

Concerning transportation, Justice officials told us that their observations to date 
were limited to the transportation of chemicals within a facility and that a broader 
review of transportation vulnerabilities outside a facility is needed. 

Methods Used to Develop Preliminary Findings 

Justice's preliminary findings are based on the work that it and Sandia did to develop 
the vulnerability assessment methodology. Consequently, the scope and limitations 
of the interim report's preliminary findings are the same as those for the 
methodology. In developing the methodology, Justice identified approximately 
15,000 U.S. facilities that produce, dispose of, or in some manner handle or use 
hazardous chemicals. Justice focused on chemical facilities that manufactured 
chemicals hazardous to human life. These were chemicals that, if inhaled or touched 
by individuals, would cause harmful or lethal results. To develop and test the 
methodology, Justice and Sandia personnel met with industry and government 
officials and visited 11 chemical manufacturing facilities from April 2001 through 



We only discuss selected information from the interim report that Justice has determined does not 
pose a threat to national security. 
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January 2002. These facilities were selected in consultation with personnel from the 
American Chemistry Council, the chemical manufacturing industry's trade 
association, who suggested that the security at these facilities was representative of a 
broad range of facilities in the industry. These facilities represented a range of 
characteristics such as (1) location — six urban and five rural sites and (2) the number 
of employees — three had more than 1,000 employees, three had fewer than 100 
employees, and the remaining five ranged from 100 to 1,000 employees. Justice and 
Sandia focused primarily on physical security at fixed sites — the security of 
electronic chemical process control systems and transportation systems was a 
secondary focus. 

Because the findings in the interim report are based on visits to only 1 1 facilities, the 
report states that caution should be exercised in generalizing the findings to the 
entire industry. However, the report also notes that these visits provided the 
department with the opportunity to identify potential threats, overall risks, and 
vulnerabilities at these chemical facilities. Also, according to Justice, chemical 
facilities that store and use chemicals may present fundamentally different security 
concerns than chemical facilities that produce or manufacture chemicals — such as 
those included in the Justice study — and that, as such, the preliminary findings and 
recommendations may not apply other than to manufacturing facilities. It is 
important to note that of the approximately 15,000 facilities covered by the Clean Air 
Act, according to an official at the Environmental Protection Agency, only about 
1,500 produce or manufacture chemicals. 

Interim Report Recommendations 

The interim report notes that in addition to the use of effective security systems, 
other remedial measures should be considered to lower the probability of a 
successful terrorist attack. Justice officials told us that these recommendations 
apply to the 1 1 facilities they visited and may not be applicable to other chemical 
facilities. While Justice has not made the recommendations publicly available, 
officials said that chemical facilities would be able to identify measures to potentially 
lower the probability of a successful terrorist attack when they conduct their own 
vulnerability assessments. 

Potential Differences Between the Interim and Final Reports 

Justice notes that its report is based primarily on information and practices 
developed prior to September 11, 2001, and therefore the findings in a final report 
may differ in some respects from those in the interim report. Furthermore, some 
chemical manufacturers have altered their security measures since September 2001, 
and those changes may not be fully reflected in the interim report. According to 
Justice officials, Sandia visited five facilities prior to, and six after, September 11, 
2001. 
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Justice Does Not Plan to Conduct the Study and Issue the Final Report Unless 



Congress Provides Requested Funding 



According to Justice officials, Justice did not comply with the CSISSFRRA 
requirement to issue the final report by August 5, 2002, because it determined that it 
did not have adequate funds in its existing budget and Congress has not provided 
funds specifically for this purpose. 9 Justice has estimated the study would cost 
$7 million, but did not provide the basis for this estimate. And while Justice could not 
identify funds to conduct a study of the security of the chemical industry, it did not 
ask Congress for funds for this purpose in fiscal year 2001 or 2002, or in the 
supplemental appropriations for either year. Justice has requested $3 million as part 
of its lump sum appropriation for Salaries and Expenses, General Administration for 
fiscal year 2003 for "chemical plant vulnerability assessments." 10 According to 
officials, Justice does not plan to conduct any further work to assess the vulnerability 
of the chemical industry, nor does it plan to issue the final report to Congress unless 
Congress enacts the lump sum appropriation in the amount Justice has requested. 

Nevertheless, while Justice's appropriations acts have not provided the department 
an earmark or a specific line item appropriation for this purpose, Justice does have 
appropriations legally available for this purpose. Justice is authorized to use its 
existing and available lump sum appropriations for this purpose. Generally, when 
Congress imposes a requirement but does not appropriate additional funds to 
specifically carry it out, an agency must use an existing appropriation to implement 
the requirement — one that is consistent with the purposes of the particular 
appropriation being charged for that expense. 11 

Justice's interim report recognizes that a vulnerability assessment would help identify 
and set priorities for security vulnerabilities at chemical facilities, compare security 
risks across chemical facilities, and help companies make the best use of security 
funding and other resources to address priority vulnerabilities. Furthermore, 
according to the administration's July 2002 National Strategy for Homeland 
Security, comprehensive vulnerability assessments of critical infrastructures enable 
authorities to evaluate the potential effects of an attack on a given facility or sector 
and to invest accordingly. 

Agency Comments and Our Evaluation 

We provided a draft of this report to the Department of Justice for its review and 
comment. Justice agreed with the majority of the observations contained in the 
report. However, Justice expressed concern that we did not place its efforts in the 
proper context when we observed that it did not use available funds to address the 
comprehensive reporting requirements included in CSISSFRRA. Justice also 
explained the notification provisions found in section 605 of its appropriations acts. 



However, CSISSFRRA authorizes such funds as may be necessary to be appropriated to Justice to 
conduct the study and report on the vulnerability of chemical facilities. 
'"Department of Justice, Fiscal Year 2003 Budget Summary, Salaries and Expenses, General 
Administration, Department Leadership. 

"See B-195007, July 15, 1980; 46 Comp. Gen. 604 (1967); 15 Comp. Gen. 167(1935). 
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We recognized the initial efforts Justice made to address the reporting requirements 
included in CSISSFRRA. As we stated in our report, Justice has partially addressed 
the CSISSFRRA mandate by preparing an interim report. We also reported that 
Justice notified the House and Senate Committees on Appropriations that it planned 
to transfer $750,000 from its Counterterrorism appropriation to develop a 
methodology. This notice explained that this money would fund phase one of its 
project to prepare a report required by CSISSFFRA. As Justice explains in its 
comments to us, section 605 of its appropriations acts required it to notify the 
committees of its proposal to use these funds. As we reported, the appropriations 
committees disagreed with this transfer and Justice elected not to proceed. Later, a 
conference committee directed Justice to use $600,000 to develop, test, and validate a 
prototype vulnerability assessment methodology. 

While Justice proposed to use $750,000 in 2000 for the first step in meeting the 
CSISSFRRA requirements, it did not attempt to use funds from any other 
appropriations or ask Congress for funds to complete a study of the security of the 
chemical industry until fiscal year 2003. As we stated in the report, we believe that 
when Congress imposes a new requirement on an agency but does not appropriate 
funds specifically to implement it, the agency must use existing appropriations to 
fund the requirement. 

The Department of Justice's letter to us is contained in enclosure I. 
Scope and Methodology 

To describe Justice's actions to review the vulnerability of the chemical industry 
against criminal and terrorist acts and to fulfill its statutorily mandated reporting 
requirements, we reviewed the requirements of the Chemical Safety Information, Site 
Security and Fuels Regulatory Relief Act and Justice's appropriations for fiscal years 
2000 to 2003 and interviewed Justice officials. We reviewed a copy of the interim 
report Justice submitted to Congress and of the vulnerability assessment 
methodology developed by Justice and Sandia. We requested a meeting with the 
Justice and Sandia personnel who were directly involved with making the 
observations on facility security, which was the basis for the interim report, but to 
date, Justice has not provided us access to them. We performed our review from 
April 2002 through August 2002 in accordance with generally accepted government 
auditing standards. 
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We are sending copies of this report to interested congressional committees. We also 
will make copies available to others upon request. In addition, the report will be 
available at no charge on the GAO Web site at http ://www. gao . gov . 

If you have any questions about this report, please contact me at (202) 512-3841. 
Major contributors to this report were Linda Libician, Leigh White, Amy Webbink, 
and Joanna McFarland. 




John B. Stephenson 
Director, Natural Resources and 
Environment 



Enclosure 
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Enclosure I 



Comments from the U.S. Department of Justice 




U.S. Department of Justice 



Washington, DC. 20S30 



OCT -3 2002 



Mr. John Stephenson 

Director, Natural Resources and Environment 
U.S. General Accounting Office 
441 G Street, NW 
Washington, D.C. 

Dear Mr. Stephenson: 

Thank you for the opportunity to review the final draft of the General Accounting Office (GAO) report, 
entitled "Homeland Security: Justices's Response to Its Congressional Mandate to Assess and Report 
on Chemical Industry Vulnerabilities, GAO-02-1 066R." This letter constitutes the formal comments of 
the Department of Justice, and I request that it be included in the final report. 

The report makes a number of observations concerning the Department's actions and statutory 
requirements to review and report on the vulnerability of chemical facilities to a terrorist or criminal 
attack. While the Department agrees with the majority of the observations contained in the report, we 
believe the GAO observation that the Department did not use available funds to address the 
comprehensive reporting requirements included in the Chemical Safety Information, Site Security and 
Fuels Regulatory Relief Act (CSISSFRRA) does not place our efforts in the proper context. The 
report states that "generally" when Congress imposes a new requirement on an agency but does not 
appropriate funds specifically to implement it, the agency must use existing appropriations to fund the 
requirement. While as a general matter this is true, the use of the Department's available funding for 
new programs, projects, or activities not specifically requested in a budget request or funded in an 
appropriations act is restricted by Section 605 of our annual appropriations acts. Section 605(a) 
requires that the Committee on Appropriations be notified 1 5 days prior to the Department using any 
appropriated monies or monies made available to the Department through the collection of fees, and 
prior to using in excess of $500,000 or 10 percent, whichever is less. The Department complied with 
Section 605 requirements in developing a funding mechanism for the Congressionally-mandated study 
cited in your report, and the proposal was then objected to by the Congress. 

Since the early 1980's, the annual Commerce, Justice, and State, the Judiciary and Related Agencies 
Appropriations Act has contained a general provision that establishes by law how and when the 
Committees on Appropriation are to be notified about changes in the way the Department executes its 
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Mr. John Stephenson 
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budget. While the Committees recognize that there will be changes during the operating year that may 
require a different allocation of resources and changes in program emphasis as priorities change, the 
Department is required by law to notify the Committees of such changes. 

Specifically, section 605(a) requires that the Committees on Appropriations be notified 15 days prior to 
the Department using any appropriated monies or monies made available to the Department through the 
collection of fees (available in the current or any prior fiscal year) to: 

• Create a new program(s); 

• Eliminate a program, project, or activity; 

• Increase funds or personnel by any means for any project or activity for which funds have been 
denied or restricted; 

Relocate an office or employees 

• Reorganize offices, programs, or activities 

• Contract out or privatize any functions, or activities presently performed by Federal employees. 

In addition, section 605(b) requires that the Committees on Appropriations be notified 15 days prior to 
the Department using in excess of $500,000 or 10 percent, whichever is less: 

• To augment existing programs, projects or activities; 

To reduce by 10 percent funding for any existing program, project, or activity, or numbers of 
personnel by 1 percent as approved by Congress; or 

• That result from any general savings from a reduction in personnel which would result in a 
change in existing programs, activities, or projects as approved by both Houses of Congress. 

Use of the Attorney General's Counterterrorism Fund, as the Department proposed in its March 31, 
2000 notification, are subject to the requirements of Section 605. Thus, after Congress passed the 
CSISSFRRA, the Department made efforts, consistent with law governing use of its appropriations, to 
fund the required report. The notice informed Congress of the Department's plans to transfer 
5750,000 from the Attorney General's Counterterrorism Fund appropriation to the Office of Justice 
Programs appropriation to develop a methodology. The Appropriations Committees objected to the 
transfer, and the Department did not proceed with it. 

However, as mentioned in your report, in the Department's FY 2001 Appropriations Act, the 
Congress did provide $600,000 to develop, test, and validate a prototype national Vulnerability 
Assessment (VA) methodology for assessing the security of chemical facilities against terrorist and 
criminal attacks, consistent with the requirements of PL 106-40 and to provide a comprehensive report 
on the findings derived from the development of the VA methodology. This report was transmitted to 
the Committees on Appropriations on May 28, 2002. In addition, the first report required under 
CSISSFRRA was transmitted to the Congress on May 30, 2002. 



10 



GAO-03-24R Security of Chemical Facilities 



Enclosure I 



Enclosure I 



Mr. John Stephenson 



3 



Finally, we recommend that the full discussion of the Department's actions regarding funding of the 
study should be included under the heading "Justice Initiated Actions to Study the Vulnerability of the 
Chemical Industry but Has Not Fully Met its Statutory Requirements," rather than under the next 
heading. 

Again, we appreciate the GAO giving the Department an opportunity to comment in this process and 
thank the Congress for its support in our continuing efforts to improve our Homeland Security. If you 
have any questions concerning the Department's comments you may contact Vickie L. Sloan, Director, 
Audit Liaison Office on (202) 514-0469. 



Sincerely, 




Robert F. Diegelman 
Acting Assistant Attorney General 
for Administration 



(360264) 
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